securing oracle linux 9 article 10 disabling and removing unnecessary services

سیستم عامل و زیرساخت Hits: 8

In the previous part

Configuring and Managing GNOME Display Manager (GDM)

was completed.

1. CIS Benchmark Requirements (Section 2.1)

This section of the CIS standard reviews server-side services and emphasizes that unused services must be stopped and disabled:

  • 2.1.1 Ensure autofs is not enabled (Automated)
  • 2.1.2 Ensure avahi-daemon is not enabled (Automated)
  • 2.1.3 Ensure DHCP Server is not enabled (Automated)
  • 2.1.4 Ensure DNS Server is not enabled (Automated)
  • 2.1.5 Ensure DNSMASQ is not enabled (Automated)
  • 2.1.6 Ensure Samba is not enabled (Automated)
  • 2.1.7 Ensure FTP Server is not enabled (Automated)
  • 2.1.8 Ensure message access server is not enabled (Automated)
  • 2.1.9 Ensure NFS is not enabled (Automated)
  • 2.1.10 Ensure rpcbind is not enabled (Automated)
  • 2.1.11 to 2.1.20 Ensure [NIS, Print, rsync, SNMP, Telnet, tftp, Squid, HTTP, Nginx, xinetd, X11] is not enabled (Automated)
  • 2.1.21 Ensure mail transfer agent is configured for local-only mode (Automated)

 

2. Concept & Rationale

Concept: Any software or service running on a server and creating an open network port is a potential attack vector.

Security Reason: Disabling or completely removing software and services that are not required for the server's core purpose significantly reduces the attack surface and prevents unnecessary consumption of system resources such as CPU and RAM.

Standard Approach: The CIS standard explicitly recommends that all application and network services that do not have a direct purpose on the server should be stopped, masked, or completely removed. In addition, the Mail Transfer Agent (MTA) should be configured only on the loopback interface so that it is not accessible from outside.

 

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

This section requires careful attention from DBAs to ensure that service hardening does not interfere with database operation:

  • General Services: Oracle database servers, even in RAC environments, have no need for services such as Web Server, Samba, FTP, DHCP, or DNS, and disabling them is completely safe.
  • NFS and Rpcbind Configuration: If you use network storage (NAS) via NFS or Direct NFS for database files or RMAN backups, your system acts only as a client. Disabling the server-side NFS service (nfs-server) does not interfere with mounting external NFS resources; however, you must make sure that NFS client packages are not removed.
  • Mail Service (MTA): Oracle Database or tools such as OEM may act as clients for sending email alerts and connect directly to the organization's SMTP server. Configuring the local MTA (such as Postfix) in loopback-only mode does not interfere with database email notifications.
  • X Window Service (X11): As noted in the previous article, after removing and disabling X11, Oracle installation or patching must be performed in Silent Mode.

 

4. Checking the Current Status (Audit Script)

To check unnecessary services and MTA configuration, use the following script:

GitHub link:

modules/audit_10_Disable_Unused_Services.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

 

#!/bin/bash
# Script: audit10.sh
# Purpose: Audit unnecessary Server Services and MTA configuration (CIS 2.1)

echo "=========================================================================="
echo " CIS Requirement: 2.1 Server Services"
echo " - Ensure unnecessary services are disabled or not installed."
echo " - Ensure MTA (Postfix) is configured for local-only mode."
echo " Oracle Context:"
echo " - Disabling 'nfs-server' does NOT affect RMAN backups using NFS Client."
echo " - Local-only MTA is fully compatible with Oracle Database email alerts."
echo "=========================================================================="

FAIL_COUNT=0
SERVICES=(
    autofs avahi-daemon dhcpd named dnsmasq smb vsftpd dovecot
    nfs-server rpcbind ypserv cups rsyncd snmpd telnet.socket
    tftp.socket squid httpd nginx xinetd
)

echo -e "\n[*] Auditing Unnecessary Services..."
for srv in "${SERVICES[@]}"; do
    if systemctl is-enabled "$srv" 2>/dev/null | grep -q 'enabled'; then
        echo -e "  \e[31m[FAIL]\e[0m Service $srv is ENABLED."
        FAIL_COUNT=$((FAIL_COUNT + 1))
    else
        echo -e "  \e[32m[PASS]\e[0m Service $srv is disabled/masked or not installed."
    fi
done

echo -e "\n[*] Auditing MTA (Postfix) listening interfaces..."
if ss -lntp | grep ':$25$' | grep -qvE '127.0.0.1|::1'; then
    echo -e "  \e[31m[FAIL]\e[0m MTA is listening on a non-loopback interface."
    FAIL_COUNT=$((FAIL_COUNT + 1))
else
    echo -e "  \e[32m[PASS]\e[0m MTA is configured securely (local-only or not listening)."
fi

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
    echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. Applying the Configuration (Remediation Bash Script)

The following script stops and masks unnecessary services and restricts the Postfix service to local mode:

GitHub link:

modules/remediate_10_Disable_Unused_Services.sh

 

#!/bin/bash
# Script: remediation10.sh
# Purpose: Disable unnecessary services and configure MTA (CIS 2.1)

if [ "$EUID" -ne 0 ]; then
    echo "Please run as root"
    exit 1
fi

echo "=========================================================================="
echo " Applying Remediation for CIS 2.1 (Server Services & MTA)"
echo " Oracle Context: Safe for DB/RAC. NFS Client & DB Alerts remain functional."
echo "=========================================================================="

SERVICES=(
    autofs avahi-daemon dhcpd named dnsmasq smb vsftpd dovecot
    nfs-server rpcbind ypserv cups rsyncd snmpd telnet.socket
    tftp.socket squid httpd nginx xinetd
)

echo -e "\n[*] Stopping and Masking unnecessary services..."
for srv in "${SERVICES[@]}"; do
    if systemctl is-active --quiet "$srv" 2>/dev/null; then
        systemctl stop "$srv"
        echo -e "  \e[32m[OK]\e[0m Stopped $srv"
    fi

    if ! systemctl is-enabled --quiet "$srv" 2>/dev/null | grep -q 'masked'; then
        systemctl mask "$srv" 2>/dev/null
        echo -e "  \e[32m[OK]\e[0m Masked $srv"
    fi
done

echo -e "\n[*] Removing X Window Server packages (if any)..."
dnf remove -y xorg-x11-server-common > /dev/null 2>&1
echo -e "  \e[32m[OK]\e[0m X Window packages removed."

echo -e "\n[*] Configuring MTA (Postfix) for local-only mode..."
if rpm -q postfix > /dev/null 2>&1; then
    sed -i 's/^inet_interfaces =.*/inet_interfaces = loopback-only/' /etc/postfix/main.cf
    systemctl restart postfix
    echo -e "  \e[32m[OK]\e[0m Postfix set to loopback-only."
else
    echo -e "  \e[32m[OK]\e[0m Postfix is not installed."
fi

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

In the next part, we will move on to

Removing Unnecessary Service Clients

.